On Thu, Sep 17, 1998 at 11:56:02AM -0700, Matthew James Gering wrote:
Regarding the tracking of mobile phones, are all current types of phones susceptible?
There was a recent post here regarding tracking of GSM phones. TDMA/CDMA, analog/digital, PCS-band, etc, are they all equally capable of being tracked?
All the wireless standards I am aware of allow for registration and polling phones to find out if they are on and available without ringing them. This provides silent location information to the nearest cell of a phone merely turned on, location which may be hundreds of feet in tightly congested urban areas and tens of square miles in suburban and less populated areas. Some system operators apparently use this feature with all active phones to relieve congestion on paging channels, while others do not actively track phones not being used except in certain situations or parts of the network. Of course location to a cell is always available during a call... The FCC has mandated that this cell-granularity location information be made available to E-911 centers on emergency calls, and there may be some situations in which it is currently made available to domestic law enforcement under other circumstances, though CALEA restricts such availability without warrents. Whether and under what circumstances law enforcement can request a poll be transmitted (re-registration) to locate a silent but powered phone is less clear. It would seem that CALEA forbids this, but what in fact is the practice by such agencies as the FBI working quietly with cell carriers in places such as NYC is less clear. In the future FCC rules will require that all E-911 calling wireless phones be located to 125 meters 67% of the time. There are proposals to do this with differential time of arrival (DTOA) or other direction finding techniques (apparently a hard problem in cities with lots of multipath propagation due to reflections) that work passively on some or all cell calls and registrations (thus allowing tracking of everybody), or by cooperation with the cellphone handset that could be only turned on when the user wished to be located (an E-911 emergency) and disabled otherwise. One version of this would use GPS rather than ranging or other techniques to determine position relative to the cell sites. Of course all the user disaablable techniques such as GPS and DTOA done in the handset firmware only will work with future cell firmware and hardware and not legacy handsets, and because of this may not be acceptable to the FCC. There are some distinctions between CDMA, GSM, analog and TDMA (non GSM), in respects to exactly how easy it is to implement precision location meeting the FCC spec passively and on all calls at all times. Apparently CDMA with its very tight power control to minimize the near-far problem makes it fairly awkward to reliably triangulate position from multiple sites since the mobile may be only detectable at one site at any time... What this means in practice is that some wireless technologies are more likely to require some definate active firmware intervention to do precision location, whilst others may allow it with no special intervention. If the FCC allows this intervention to be enabled by a user, this may provide some opportunity for location privacy.
However pagers are not, correct? They just broadcast an entire area to page instead of the pager keeping the network informed of their location.
The one way pagers work this way. The guaranteed delivery two way pagers do support registration and will know the location of the pager after a page has been sent to it and any time the system wants to determine it. This location will be quite coarse with current two way (reFlex) pagers with cell sites some distance apart, but DF techniques are quite possible and could be implemented by law enforcement or spooks or other interested groups. Unlike wireless phones there is no current FCC requirement for positioning information distribution or precision positioning infrastructure, so two way pagers aren't likeyly to be routinely located accurately any time soon. Of course most modern wireless phones support paging message delivery, so more and more people will be using wireless phones with the FCC mandated tracking accuracy for paging...
One thing I have long wondered: Why don't they make phones that "wake-up" by a paging signal and then accept the call? It might increase the connect time significantly, but it would also increase the potential stand-by time indefinitely, and the location of the user is only exposed when calls are in progress, not while the phone is on stand-by.
Wireless phones do currently work this way. They listen to the forward control channel for a paging message that says they have got a call coming in and only then do they transmit. The amount of power used in transmitting would quickly use up the battery if they continuously broadcast. The problem with cellphone location is that they can also be paged with a registration request that does not cause them to ring or show any evidence of transmitting, but sends back a brief message burst (not using much battery). This can be made to happen every so often, or only when polled.
Are there any paging services (particularly alpha paging) that work on a global scale? You would think daily pager rental service (esp. at airports) would be popular. You could have an email address, even a static phone number, that could re-route messages to any pager that you happen to have at the time (PSTN-IP-PSTN, or even easier if the pager service gives SMTP addresses, which most do these days).
There are nationwide pager services that broadcast your pages over very wide areas or depend on registration to locate you down to a smaller area. But yes, you can get paged anywhere in the US and several other countries. And the new LEO satellite technology will allow paging over whole continents or potentially anywhere in the world.
Similarly a PSTN-IP-PSTN interface for voice could give you a static phone number that you could dynamically forward anywhere untraceably.
The LEAs don't like this concept, and one of the provisions of the CALEA wiretap stuff is providing tracing of calls forwarded so you can't do this.... -- Dave Emery N1PRE, die@die.com DIE Consulting, Weston, Mass. PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18